Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

It sent VOIP requests to non-existent extensions.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

This IP was linked to an attempt at distributing malicious software within our system.

The IP was flagged for attempting dictionary attacks on our user accounts.

This IP was responsible for circulating malicious images masked with spyware.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP has been implicated in multiple cases of URL manipulation attempts.

It attempted to send emails from the Postfix server that violate the server's email content policy.

Attempts to use privileged service accounts outside of their normal usage patterns.

This IP blocked legitimate users by performing IP hijacking.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The IP was involved in attempts of defacing the Apache server website.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

This IP was traced back to several attempts to access domain admin credentials.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

Unexpected changes in the server configuration or installed software.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

Multiple requests with identical Accept-Encoding headers.

It attempted to send emails with deceptive subject lines from the Postfix server.

The IP attempted to use the Mail server to relay spam to other servers.

It attempted to use the Postfix server to relay phishing emails to other servers.

Our system flagged the IP for injecting malicious script into benign pages through the man-in-the-browser attack.